Account Lockout (part 4 of 4)

In the previous article --- Account Lockout (part 1 of 4), I ever enable NETLOGON record function by the command “nltest /dbflag:0x2080ffff” so that its behavior will be recorded on C:\Windows\Debug\netlogon.log
Or add registry entity DBFlag on “HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters”
In the moment, I will use nlparse.exe this utility to analyze netlogon.log
Open nlparse.exe by Run as administrator The error message will show up and tell us that component ‘comdlg32.ocx’ or one of its dependencies not correctly registered.
Search the related information about this error message by Google and find we can directly download VB6 Common Control comdlg32.ocx from this URL http://activex.microsoft.com/controls/vb6/comdlg32.CAB

After download finish, double-click comdlg32.CAB this file next to copy comdlg32.ocx to C:\Windows\SysWOW64\Open command prompt by Run as Administrator, execute “regsvr32 c:\Windows\SysWOW64\comdlg32.ocx” to register cmdlg32.If it success, please run nlparse.exe again so that Netlogon-Parse GUI will show up normally now.
Click Open button
Expand C:\Windows\debug folder and select netlogon.log this file next to click Open button
Enable 0xC000006A (no any record if authentication is Kerberos) and 0xC0000234 check box next to click Open button
You will see the message as “C:\Windows\debug\netlogon.log Done!”
Under this folder C:\Windows\debug, there are generated two file with extension format as txt and csv.
Now you can open these file to realize who is locked by which computer.

Reference：
(1). Support Statement for Visual Basic 6.0 on Windows Vista, Windows Server 2008, Windows 7, and Windows 8
(2). If O.S. is 32bit, please copy comdlg32.ocx to C:\Windows\System32\(3). If the debug finish, please remember to disable NETLOGON record by command “nltest /dbflag:0x0” and restart netlogon service so that avoid the disk space overload.

<<<   Account Lockout (part 3 of 4)

Account Lockout (part 1 of 4)   >>>